Version 1.0 of getdns offers a daemon mode which can be used to run getdns locally as a DNS-over-TLS stub resolver. The daemon can listen on the loopback address send all outgoing DNS queries over TLS to a DNS Privacy server. Version 1.1 of getdns includes some performance improvements to make this mode more robust, so it is currently recommended to use that code, rather than the 1.0 release. If you want to set this up on your laptop/desktop follow the step-by-step instructions below!

1.1. Dependencies

In this mode, the only dependency is OpenSSL (version 1.0.2 or later is required for hostname authentication to be supported). If this is installed in a non-standard location on your system use the --with-ssl option to configure below to specify where it is.

1.3. Build the code

If you want to see very detailed debug information as messages are processed (including connection statistics) then add the --enable-debug-stub option to the configure line above.

If you just want to see connection statistics then use the --enable-debug-daemon option instead to the configure line above.

1.4. Run the daemon

The command below will run the daemon listening on port 53 of the loopback address and sending queries to the NLnet Labs test DNS Privacy server (at 185.49.141.38 and 2a04:b900:0:100::38) over TLS. (More test servers are listed here).

It also specifies an example idle timeout on the TLS connection of 10s with the '-e 10000' option. (Note: the NLnet Labs test server does not support EDNS0 TCP Keepalive yet, so in that case this timeout will always be used.)

It is recommended to use more than one upstream for increased performance and reliability.

1.5. Test the daemon

A quick test can be done by using dig on the loopback address

> dig @127.0.0.1 www.example.com

1.6. Modify your upstream resolvers

For getdns to re-send outgoing DNS queries over TLS the recursive resolvers configured on your machine must be changed to send all the local queries over the loopback interface on which getdns is listening. This depends on the operating system being run. It is useful to note your existing default nameservers before making this change!

Linux/Unix systems

Edit the /etc/resolv.conf file

Comment out the existing nameserver entries

Add the following (only add the IPv4 address if you don't have IPv6)

nameserver 127.0.0.1
nameserver ::1

OS X

From the command line you can do the following to set the local DNS servers on, for example, your 'Wi-Fi' interface (first line clears all servers, second line adds localhost):

If you want to reset, use something similar to the above to specify your default servers.

Or via the GUI:

Open System Preferences->Network->Advanced->DNS

Use the '-' button to remove the existing nameservers

Use the + button to add '127.0.0.1' and '::1' (only add the IPv4 address if you don't have IPv6)

Hit 'OK' in the DNS pane and then 'Apply' on the Network pane

Once the change in step 1.6 is made your queries will be re-directed to the getdns daemon and sent over TLS! You can monitor the traffic using Wireshark watching on port 853.

Notes:

You may need to restart some applications to have them pick up the network settings

If you are using a DNS Privacy server that does not support concurrent processing of TLS queries, you may experience some issues due to timeouts causing subsequent queries on the same connection to fail.

The daemon currently (indefinitely) backs-off servers that provide poor service - the next version will have a timed re-try in this case.